CVE-2026-4116 Auth bypass in SMA1000

High 7.2 Published 9 Apr 2026 Updated 13 Apr 2026

Remote authenticated users can bypass TOTP authentication in SonicWall SMA1000 appliances due to improper Unicode handling.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-4116?

CVE-2026-4116 is a high-severity authentication bypass vulnerability in SonicWall SMA1000, published on 9 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.

Weakness: CWE-176

Which versions are affected by CVE-2026-4116?

It affects 5 products.

Products include Sonicwall Sma6200 Firmware, Sonicwall Sma6210 Firmware, Sonicwall Sma7200 Firmware, Sonicwall Sma7210 Firmware, Sonicwall Sma8200v.

How do I fix CVE-2026-4116?

No fix has been published for CVE-2026-4116 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-4116 being exploited?

There is no known exploitation of CVE-2026-4116 in the wild and no public exploit code.

Sources

Also known as GHSA-98v3-fwpf-r4w2.